apexledger.
How your clients' data is protected
A bookkeeping firm holds other people's books. ApexLedger was built around that responsibility: the data stays in Canada, every firm is walled off from every other, every person has their own sign-in, and every change carries a name. Here is exactly how.
Where the data lives
Canada only
The application and every company file run in Microsoft Azure's Canada Central region (Toronto). Backups are copied to Canada East (Québec City). Nothing is stored or processed outside Canada.
Azure Canada Central · Canada EastCertified data centres
Microsoft Azure data centres hold ISO 27001, ISO 27017, ISO 27018, SOC 1, SOC 2 and SOC 3 attestations and meet the Government of Canada's Protected B requirements. ApexLedger runs on that foundation.
Microsoft Azure complianceEncrypted at rest
The disks holding company files and backups are encrypted by Azure Storage Service Encryption with 256-bit AES. Backup copies are encrypted in the same way.
AES-256 · Azure managed disksEncrypted in transit
Every connection uses HTTPS with TLS 1.2 or newer and a certificate that renews automatically. Browsers are told to use HTTPS only (HSTS) for a year, so an unencrypted connection is never attempted.
TLS 1.2+ · HSTSOne firm can never see another
One file per company, one folder per firm
Each client company is a separate database file in a folder that belongs to one organisation. There is no shared table of transactions across firms, so there is no filter that could ever be wrong. A request from one firm cannot name, open, upload to or download from another firm's folder; the server refuses it by path.
Verified with a two-firm test on every routeSessions are separate too
Every request runs inside its own session with its own database connection, resolved from the sign-in cookie on the server, never from anything the browser sends. Two firms working at the same moment never receive each other's data.
Per-session connectionsWho can do what
Named sign-ins, no sharing
Every person has their own email and password, or signs in with their Microsoft account. Passwords are stored as salted scrypt hashes, never in clear. Eight failed attempts from one address lock it out for fifteen minutes.
scrypt · lockout · Microsoft sign-inAccess follows the seat
Business, Payroll Unlimited, Bookkeeper and Full accountant seats each reach only their part of the application. The server enforces it on every request, so a payroll clerk cannot read the ledger and a bookkeeper cannot run the accountant's year-end tools, whatever the screen shows.
Enforced on the server, not in the browserEvery change carries a name
The Activity Log records who did what and when, for every entry and every edit. Posted entries are voided, never deleted; filed returns lock their period.
Full audit trailDownloads and uploads are checked
A download link works only for the session that asked for it, once. Uploaded company files must be genuine database files; uploaded documents are stored, never executed.
Single-use links · validated uploadsThe server and the network
| Firewall | The network security group allows only HTTPS (TCP 443) from the internet. Administrative access is allowed from one address only, with key-based authentication and no password. Nothing else is reachable. |
|---|---|
| Browser protections | Every response carries a strict Content-Security-Policy (scripts and connections only from the application itself), no-framing, no-sniff, referrer and permissions policies. The application has no inline scripts and loads nothing from third parties. |
| Backups | Azure Backup takes a snapshot of the data disk every night and keeps 30 days, with the vault's geo-redundant copy in Canada East. Any firm can also download a consistent copy of any company file at any time. |
| Monitoring | Azure Monitor watches the server's availability and alerts us if it is unreachable for five minutes. |
| Updates | Application updates are deployed to the server; there is nothing to install or patch on your computers. Nobody is signed out by a deploy. |
What we do not do
- We do not move or process your data outside Canada.
- We do not use your books to train any AI. The optional assistant and voice recognition are off by default and run on the same Canadian server when turned on.
- We do not run analytics or tracking scripts on the application, and none on this website.
- We do not open a firm's company file except to support that firm at its request, and every such access is logged.
- We do not sell, share or aggregate customer data.
Your side of it
Security is shared. Keep sign-ins personal, deactivate people who leave (owners do this themselves on the Administration page), use "Sign in with Microsoft" where your firm has two-step verification, and review what you file. The Subscription Agreement sets this out.